Include asset tags in Azure Monitor alerts

[odallal]

Hi,

Is it possible to include tags in the azure monitor alert (the tags configured on the resource on which the alert was triggerred, like "Environment:prod/test/qa")?

Ohad.

[#2]

@odallal 

Hi Ohad,

Currently, if you want to enrich the alert with the resource tag, you will need to do it yourself, for example - using a Logic App action in the action group.

We are considering adding this functionality out-of-the-box later in 2021.

Thanks,

   Ofir

[#3]

I got an offline question about this, so updating for future readers who may run into that....

In Logic App, you can have an HTTP action. You can use it to call the following ARM API that returns the tags on an Azure resource:
Tags - Get At Scope - REST API (Azure Resource Management) | Microsoft Docs

[#4]

@ofmanor 

Is there any update on Adding Asset Tags in Azure Monitor Alert (apart from using Logic App)?

- We have requirement to enrich the Alert with Asset Tags before sending it to any third-party tool for further action.

[#5]

Hi @ravigupta1 

We are working these days on planning our next developments, and this is part of our backlog. we will be happy to meet you and discuss on your requirements.

Can you contact me directly noga.lavi@microsoft.com ?

Thanks!

[#6]

Is this still not available out of the box?
Would LOVE to have this available, so we can start using policy based alerting, without having to target my alerts based on tags, I want my external solution to just receive all alerts and based priority/severity there based on the tags.

[#7]

Can we expect this feature in near future?

[#8]

We are working the next following months on adding an enrichment to log search alerts with MSI. We do not have a specific date for this delivery, but we are working on make it available. Once the enrichment will be available you will be able to query the tags from ARG and to have it in the payload.

[#9]

Yes, it is possible to include tags in Azure Monitor alerts by using Azure Logic Apps or Azure Functions to enrich the alert payload with the resource tags.

Here’s a step-by-step approach to accomplish this:

1. Create the Azure Monitor Alert:

   • Set up your alert rule in Azure Monitor based on your criteria.

2. Trigger a Logic App or Azure Function:

   • Configure the alert to trigger an Azure Logic App or an Azure Function. This can be done in the "Actions" section of the alert rule, where you can specify an Action Group to call a Logic App or Function.

3. Retrieve Resource Tags:

   • In your Logic App or Azure Function, use Azure Resource Manager (ARM) REST API to get the tags for the resource. This can be done by making an HTTP request to the ARM endpoint for the resource.

   For Logic Apps:

   • Use the HTTP action to call the ARM REST API.

   For Azure Functions:

   • Use the appropriate SDK or HTTP client to call the ARM REST API.

4. Enrich the Alert Payload:

   • Extract the tags from the ARM response and append them to the alert payload.

Example in a Logic App:

json

{
"actions": [
{
"call": {
"method": "GET",
"uri": "https://management.azure.com/{resourceId}?api-version=2021-04-01",
"headers": {
"Authorization": "Bearer {token}"
}
},
"extract": {
"path": "$.tags"
},
"compose": {
"inputs": {
"tags": "@body('HTTP')['tags']"
}
}
}
]
}

5. Notify or Act on the Enriched Alert:

• Send the enriched alert payload to your desired endpoint (email, SMS, ITSM system, etc.) using the appropriate actions in your Logic App or Azure Function.

By following these steps, you can include the tags configured on the resource in the Azure Monitor alert payload. This approach allows you to have more context about the resource when an alert is triggered.

@odallal